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DESCRIPTION 
Information Processing Device and Method 
Technical Field 

This invention relates to an information processing method, an information 
processing device, an information recording medium and a computer program. More 
particularly, it relates to an information processing method, an information processing 
device, an information recording medium and a computer program, which are 
configured so that keys necessary for recording and/or reproducing content data, such 
as a master key, a media key or a content key, are distributed or acquired, using a 
hierarchical key distribution system of a tree structure, and in which respective devices 
record or reproduce the content data using these keys. 
Background Art 

In keeping up with progress and development of digital signal processing 
techniques, recording devices or recording media for digitally recording the 
information, are finding widespread use. With the digital recording device or recording 
medium, since copying can be repeatedly made without degrading the sound or picture 
quality, recording media obtained on unauthorized duplication may be circulated on 
the market, thus impairing the benefit of the copyright owners or authorized 
distributers of various contents, such as music or motion pictures. Nowadays, various 
techniques or systems for preventing unauthorized duplication have been introduced 
in the digital recording devices or digital recording media in order to prohibit such 
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unauthorized duplication of digital data. 

For example, in a MD (mini-disc), MD being a trademark, an SCMS (Serial 
Copy management System) is used as a method of prohibiting unauthorized 
duplication. The SCMS is such a system in which, on the data reproducing side, an 
SCMS signal is output along with audio data from a digital interface (DIF) and, on the 
receiving side, the recording of audio data from the reproducing side is controlled 
based on the SCMS signal from the reproducing side to prohibit the unauthorized 
duplication. 

Specifically, the SCMS signal is such a signal indicating whether given audio 
data is copy-free data, for which copying can be made any number of times, copy- 
once-allowed data, for which copying is allowed only once, or copy-prohibited data, 
for which copying is prohibited. On receipt of audio data from the DIF, the data 
recording side detects the SCMS signal, sent along with the audio data. If the SCMS 
signal is copy-free, the audio data is recorded, along with the SCMS signals, on a mini- 
disc. If the SCMS signal is copy-once-allowed, the SCMS signal is changed to copy- 
prohibited and is recorded along with the audio data on the mini-disc. If the SCMS 
signal is copy-prohibited, audio data is not recorded. By this control employing the 
SCMS, unauthorized duplication of audio data, protected by copyright, may be 
prevented from occurring. 

However, with the SCMS, it is prerequisite that the data recording equipment 
itself owns the structure of controlling the recording of the audio data from the 
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reproducing side, based on the SCMS signals, as described above. Thus, if the mini- 
disc not having the structure of executing the SCMS control is produced, it is difficult 
to cope with the illicit copying. So, the DVD player, for example, is configured for 
prohibiting illicit copying of copyright-protected data by exploiting a content scramble 
system. 

In the content scramble system, video or audio data are recorded encrypted in 
a DVD-ROM(Read Only Memory), and a key used for decoding the encrypted data 
(decrypting key) is given a licenced DVD player. It is a DVD player, designed to 
comply with preset operational regulations, such as not undertaking illicit copying, that 
is licensed. So, the licenced DVD player is able to reproduce the pictures or speech 
from the DVD-ROM by decoding the encrypted data, recorded on the DVD-ROM, by 
exploiting the accorded key. 

On the other hand, an unlicenced DVD player, not having a key for decoding 
the encrypted data, is unable to decode the encrypted data recorded on the DVD- 
ROM. Thus, with the content scramble system configuration, a DVD player not 
meeting required conditions at the licencing time cannot reproduce the DVD-ROM 
having digital data recorded thereon, thus prohibiting unauthorized duplication. 

However, the content scramble system, used in the DVD-ROM, is designed for 
a recording medium on which data writing by the user is impossible (this sort of the 
recording medium is incidentally referred to below as ROM media), while account is 
not taken of application thereof to a recording medium on which data writing by the 
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user is possible (this sort of the recording medium is incidentally referred to below as 
RAM media). 

That is, if the data recorded on the ROM media is encrypted, but the encrypted 
data is copied in its entirety on the RAM media, the result is a so-called pirate edition 
reproducible on a licenced authorized device. 

The present Assignee proposed in our senior patent application (Japanese 
Laying-Open Patent Publication H-l 1-224461; JP Patent Application 10-25310) a 
configuration in which the information for identification of individual recording media, 
referred to below as medium identification information, is recorded along with other 
data on a recording medium in question to permit only the licenced authentic device 
to access the medium identification information of the recording medium. 

With this method, data on the recording medium is encrypted by the media 
identification information and a secret key (master key), obtained on licencing, such 
that, if an unlicenced device or equipment reads out the encrypted data, no meaningful 
data can be produced. It is noted that the device has its operation regulated at the time 
of licencing so that illicit duplication (unauthorized copying) is prohibited. 

An unlicenced device cannot access the media identification information, while 
the medium identification information is of a value specific to each medium, so that, 
if such unlicenced device duplicates the totality of the encrypted data, recorded on the 
recording medium, on a new recording medium, the data recorded on the so produced 
recording medium cannot be decrypted correctly on a licenced device, to say nothing 
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of the unlicenced device, thus effectively prohibiting the unauthorized duplication. 

Meanwhile, in the above configuration, a master key stored in a licenced device 
or equipment is usually common to all devices or equipment. The reason the master 
key common to the plural equipment is stored is that this represents an essential 
condition in order to make the media recorded on a given equipment reproducible on 
other equipment, that is to assure interoperability. 

If, in such system, a hacker has succeeded in aggressing an equipment and has 
taken out the master key, the data recorded enciypted can be decrypted in the entire 
system, thus leading to breakdown of the entire system. In order to prevent this from 
occurring, it is essential that, if it is revealed that a given equipment has been attacked 
and a master key has become explicit, the master key be changed to a new one, which 
then is given the totality of the equipment except the equipment which has succumbed 
to the attack. As the simplest system to realize this configuration, a key unique to each 
equipment (device key) may be given each equipment and a value obtained on 
encrypting the new master key with the individual device key may then be formed and 
transmitted to each equipment through a recording medium. However, in this case, the 
volume of the entire messages to be transmitted is undesirably increased in proportion 
to the number of the equipment. 

As the configuration which possibly overcomes such problem, the present 
Assignee has already proposed in our co-pending patent application (JP Patent 
Application 2000- 1 05328) a configuration employing a key distribution methodhaving 
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respective information recording and/or reproducing devices arranged at respective 
leaves of an n-branched tree, in which a key necessary for recording the content data 
on a recording medium or reproduction from the recording medium (master key or 
media key) is distributed through a recording medium or over a communication 
network, each equipment then undertaking recording or reproduction of the content 
data using the so distributed master key or media key to enable the key to be 
distributed to authorized equipment (equipment in which secrecy is not disclosed) with 
a lesser message volume. Specifically, a key required in generating a key required for 
recording on a recording medium or reproduction from the recording medium, for 
example, a node key allocated to each leaf or node of a n-branched tree, is set as a 
renewal node key. The renewal node key is encrypted such that decryption is possible 
with a leaf key or a node key owned solely by the authorized equipment, and the 
resulting encrypted information is included in a key renewal block (KRB) which is 
then distributed to each information recording and/or reproducing equipment. On 
receipt of the key renewal block (KRB), each recording and/or reproducing equipment 
executes KRB decrypting processing to acquire the key necessary in recording or 
reproduction on or from the recording medium. 

If the key distributing method, having the information recording and/or 
reproducing equipment arranged at the respective leaves of a n-branched tree, is used, 
for example, if media keys allocated to respective recording media, are encrypted with 
the key renewal block (KRB) and distributed in this form, each recording and/or 
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reproducing equipment has to cany out media key calculations, using the key renewal 
block (KRB) and the device key, each time the recording media are accessed. Since 
the volume of these calculations is proportionate to the product of the time needed in 
decrypting the individual encrypted messages and the tree depth up to the leaves 
corresponding to the recording and/or reproducing equipment, the processing 
overhead is increased in the case of a large-sized system having a large number of the 
devices. 

The present Assignee has already proposed a configuration employing a key 
distribution method having respective recording and/or reproducing equipment 
arranged at respective leaves of an n-branched tree, in which a content key as a cipher 
key necessary for recording and/or reproducing the content data on or from the 
recording medium is furnished through a recording medium or over a communication 
network (JP Patent Application 2000-105329). This configuration is such a one in 
which the content data and a content key corresponding to the encrypted content data 
are sent e.g., over a communication network, with the content key being sent as 
encrypted data. 

The encrypted content key is furnished using a key renewal block (KRB) 
obtained on encrypting a node key allocated to a node forming each leaf of a n- 
branched tree set as renewal node key, such that the renewal node key can be 
decrypted with a leaf key or a node key owned solely by an authorized equipment. By 
furnishing the content key encrypted by the renewal node key, only the authorized 
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recording and/or reproducing device is able to acquire the content key. 

If the encrypted content key is furnished using the key distribution method 
having the information recording and/or reproducing devices arranged at the respective 
leaves of the n-branched tree, each recording and/or reproducing device has to process 
the KRB with the device key (leaf key) to calculate the content key, each time the 
content is used, for example, each lime the content is reproduced from the recording 
medium. 

Since the volume of these calculations is proportionate to the product of the 
time needed in decrypting the individual encrypted messages and the tree depth up to 
the leaves corresponding to the recording and/or reproducing equipment, the 
processing overhead is increased in the case of a large-sized system having a large 
number of the recording and/or reproducing device. 
Disclosure of the Invention 

For overcoming the above-mentioned problem, the present invention is aimed 
to provide a configuration employing a key distributing method including recording 
and/or reproducing equipment arranged at respective leaves of an n-branched tree, in 
which the processing of calculating the encrypted key or decrypting key based on the 
key renewal block (KRB) is omitted to enable the encrypted key or the decrypting key 
to be acquired in a short time. More specifically, the present invention is aimed to 
provide an information processing method, an information processing device, an 
information recording medium and a computer program, in which, after acquiring a 



.!. II O & '-9 .:.!!,. ill!-!. „ O 6. .1. : : J LI! £* 




9 



media key of a recording medium on calculations, a given recording and/or 
reproducing device encrypts the so acquired media key using a cipher key unique to 
the recording and/or reproducing device, and stores the so encrypted media key, so 
that, when the recording medium is used next time, the media key can be calculated 
on decrypting the cryptotext only once, thereby enabling the content key as the 
encrypted key or the decrypting key to be acquired in a short time. 

The present invention is also aimed to provide a configuration of providing a 
content key as an encrypted key or the decrypting key employing a key distributing 
method including recording and/or reproducing equipment arranged at respective 
leaves of an n-branched tree, in which the processing of calculating the encrypted key 
or decrypting key based on the key renewal block (KRB) is omitted to enable the 
content key as the encrypted key or the decrypting key to be acquired in a short time. 
More specifically, the present invention is aimed to provide an information processing 
method, an information processing device, an information recording medium and a 
computer program, in which, after acquiring a content key for content stored in a 
recording medium on calculations, a given recording and/or reproducing device 
encrypts the so acquired content key using a cipher key unique to the recording and/or 
reproducing device, and stores the so encrypted content key, so that, when the 
recording medium is used next time, the content key can be calculated on decrypting 
the cryptotext only once, thereby enabling the content key as the encrypted key or the 
decrypting key to be acquired in a short time. 
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The present invention provides an information processing device for processing 
encrypted data, including storage means for holding a node key unique to each of a 
plurality of nodes forming a hierarchical tree structure having a plurality of such 
information processing devices, operating as leaves, and a leaf key unique to each of 
the information processing devices, and encryption processing means for executing 
encryption processing. The encryption processing means executes decryption 
processing of decrypting a key block formed as key storage data that can be decrypted 
using at least one of the node key and the leaf key held by the storage means to effect 
calculation processing of calculating a decrypting key used in decrypting the encrypted 
data. The encryption processing means also effects encrypting processing for 
encrypting the calculated decrypting key using a key unique to the processing device 
to store the encrypted decrypting key on a recording medium or in a storage area in the 
information processing device. 

The present invention also provides an information processing device for 
processing encrypted data, including storage means for holding a node key unique to 
each of a plurality of nodes forming a hierarchical tree structure having a plurality of 
such information processing devices, operating as leaves, and a leaf key unique to each 
of the information processing devices, and encryption processing means for executing 
encryption processing. The encryption processing means executes decryption 
processing of decrypting a key block formed as key storage data that can be deciypted 
using at least one of the node key and the leaf key held by the storage means to effect 
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calculation processing of calculating a decrypting key used in decrypting the encrypted 
data. The encryption processing means stores the calculated decrypting key in a 
storage area in the information processing device in association with a generation 
number as the renewal information for the decrypting key. 

The present invention also provides an information processing device for 
processing encrypted data, including storage means for holding a node key unique to 
each of a plurality of nodes forming a hierarchical tree structure having a plurality of 
such information processing devices, operating as leaves, and a leaf key unique to each 
of the information processing devices, and encryption processing means for executing 
encryption processing. The encryption processing means executes decryption 
processing of decrypting a key block formed as key storage data that can be decrypted 
using at least one of the node key and the leaf key held by the storage means to effect 
calculation processing of calculating a decrypting key used in decrypting the encrypted 
data. The encryption processing means stores the calculated decrypting key in a 
storage area in the information processing device in association with the identification 
information used for discriminating the data decrypted using the decrypting key. 

The present invention also provides an information processing device for 
processing encrypted data, including storage means for holding a node key unique to 
each of a plurality of nodes forming a hierarchical tree structure having a plurality of 
such information processing devices, operating as leaves, and a leaf key unique to each 
of the information processing devices, and decrypting processing means for executing 
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deciypting processing. The decrypting processing means reads in a table stored in a 
recording area on a recording medium or in the information processing device to 
retrieve whether or not a decrypting key used for decrypting the encrypted data is 
stored therein. The decrypting processing means effects decrypting processing of the 
encrypted decrypting key stored on the recording medium or in the recording area in 
the information processing device in case of detection of the decrypting key to 
calculate the decrypting key used for decrypting the encrypted data. The decrypting 
processing means effects decrypting processing of a key block formed by decryptable 
key storage data, in case of failure in detecting the decrypting key, using at least one 
of the node key and the leaf key held by the storage means, to calculate the decrypting 
key used in decrypting the encrypted data. 

The present invention also provides an information processing method used in 
a plural number of information processing devices for processing encrypted data, 
there being a node key unique to each node having a hierarchical tree structure having 
a plural number of such information processing devices operating as leaves and a leaf 
key unique to each information processing device. The present method decrypts a key 
block formed by key storage data decryptable using at least the node key or the leaf 
key held by each of the information processing devices to calculate the decrypting key 
used in decrypting the encrypted data to encrypt the so calculated decrypting key using 
the key unique to each information processing device to store the encrypted decrypting 
key in a recording medium or in a recording area in the information processing device. 
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The present invention also provides an information processing method used in 
a plural number of information processing devices for processing encrypted data, there 
being a node key unique to each of a plurality of nodes forming a hierarchical tree 
structure having a plurality of such information processing devices operating as leaves, 
and a leaf key unique to each of the information processing devices, in which the 
method includes decrypting a key block formed as key storage data that can be 
decrypted using at least one of the node key and the leaf key held by the information 
processing device, calculating a decrypting key used for decrypting encrypted data and 
storing the calculated decrypting key in a storage area in the information processing 
device in association with a generation number as the renewal information of the 
deciypting key. 

The present invention also provides an information processing method used in 
a plural number of information processing devices for processing encrypted data, 
there being a node key unique to each of a plurality of nodes forming a hierarchical 
tree structure having a plurality of such information processing devices operating as 
leaves, and a leaf key unique to each of the information processing devices, in which 
the method includes decrypting a key block formed as key storage data that can be 
decrypted using at least one of the node key and the leaf key held by the information 
processing device, calculating a decrypting key used for decrypting encrypted data, 
and storing the calculated decrypting key in a storage area in the information 
processing device in association with the identification information for discriminating 
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the data decrypted using the decrypting key. 

The present invention also provides an information processing method used in 
a plural number of information processing devices for processing encrypted data, 
there being a node key unique to each of a plurality of nodes forming a hierarchical 
tree structure having a plurality of such information processing devices as leaves, and 
a leaf key unique to each of the information processing devices, in which the method 
includes reading in a table stored on a recording medium or in a storage area in an 
information processing device, retrieving whether or not there is stored a decrypting 
key used in decrypting the encrypted data and decrypting the encrypted decrypting key 
stored on the recording medium or in the recording area in the information processing 
device, in case the decrypting key has been detected, to calculate a decrypting key used 
in decrypting the encrypted data, and decrypting, in case of failure in detecting the 
decrypting key, a key block formed by key storage data, decryptable using at least one 
of the node key and the leaf key held by the information processing device, to calculate 
the decrypting key used in decrypting the encrypted data. 

The present invention also provides a computer program executed on a plural 
number of information processing devices for processing encrypted data, there being 
a node key unique to each of a plurality of nodes forming a hierarchical tree structure 
having a plurality of such information processing devices operating as leaves, and a 
leaf key unique to each of the information processing devices, in which the computer 
program includes decrypting a key block formed as key storage data that can be 
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deciypted using at least one of the node key and the leaf key held by the storage 
means, calculating a decrypting key used in decrypting the encrypted data, encrypting 
the calculated decrypting key using a key unique to the processing device, and storing 
the enciypted decrypting key on a recording medium or in a storage area in the 
information processing device. 

The present invention also provides a computer program executed on a plural 
number of information processing devices for processing encrypted data, there being 
a node key unique to each of a plurality of nodes forming a hierarchical tree structure 
having a plurality of such information processing devices operating as leaves, and a 
leaf key unique to each of the information processing devices, in which the program 
includes decrypting a key block formed as key storage data that can be decrypted using 
at least one of the node key and the leaf key held by the information processing device, 
calculating a decrypting key used for decrypting encrypted data and storing the 
calculated decrypting key in a storage area in the information processing device in 
association with a generation number as the renewal information of the decrypting key. 

The present invention also provides a computer program executed on a plural 
number of information processing devices for processing encrypted data, there being 
a node key unique to each of a plurality of nodes fonning a hierarchical tree structure 
having a plurality of such information processing devices operating as leaves, and a 
leaf key unique to each of the information processing devices, in which the computer 
program includes decrypting a key block formed as key storage data that can be 
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decrypted using at least one of the node key and the leaf key held by the information 
processing device, calculating a decrypting key used for decrypting encrypted data, 
and storing the calculated decrypting key in a storage area in the information 



the data decrypted using the decrypting key. 

The present invention also provides a computer program executed on a plural 
number of information processing devices for processing encrypted data, there being 
a holding a node key unique to each of a plurality of nodes forming a hierarchical tree 
structure having a plurality of such information processing devices, operating as 
leaves, and a leaf key unique to each of the information processing devices, in which 
the computer program includes reading in a table stored on a recording medium or in 
a storage area in an information processing device, retrieving whether or not there is 
stored a decrypting key used in decrypting the encrypted data, decrypting the 
encrypted decrypting key stored on the recording medium or in the recording area in 
the information processing device, in case the decrypting key has been detected, to 
calculate a decrypting key used in decrypting the encrypted data, and decrypting, in 
case of failure in detecting the decrypting key, a key block formed by key storage data 
decryptable using at least one of the node key and the leaf key held by the information 
processing device, to calculate the decrypting key used in decrypting the encrypted 
data. 

The present invention also provides an information recording medium in which 



processing device in association with the identification information for discriminating 
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the recorded information can be read out by a plural number of information piocessing 
devices wherein a decrypting key, that is a key used for decrypting the encrypted data, 
is recorded as a key storage table in association with the identification information of 
the information processing device. 

In the configuration of the present invention, the volume of distributed 
messages required for key renewal is suppressed by employing the hierarchical key 
distribution system of a tree structure. That is, the key distribution method of a 
configuration having respective equipment arranged at respective leaves of a n- 
branched tree is used. The keys necessary for recording content data on a recording 
medium or reproducing data from the recording medium (master key, media keys or 
content keys) are distributed via recording medium or over a communication network. 
Using these keys, the respective devices record or reproduce content data. By the key 
distribution system of the tree structure, the media key to be renewed is transmitted 
along with the key renewal block (KRB), with the recording and/or reproducing device 
then calculating and acquiring the media key of the recording medium based on the 
received KRB to encrypt the acquired media key using a cipher key unique to the 
recording and/or reproducing device, such as a leaf key, to store the encrypted leaf key 
for storage in the recording medium or in the memory of the recording and/or 
reproducing device. Thus, when the recording medium is to be used next time, the 
recording and/or reproducing device is able to calculate the media key on decrypting 
the encrypted key only once to decrease the volume of the processing operations, such 
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as KRB deciypting processing as needed for the recording and/or reproducing device 
to access the recording medium. 

Similarly, by the key distributing configuration of the tree structure, the content 
key for encrypting the content is transmitted along with the key renewal block (KRB), 
with the recording and/or reproducing device then acquiring the content key based on 
the received KRB and encrypting the cipher key unique to the recording and/or 
reproducing device, such as a leaf key, to store the resulting encrypted key on a 
recording medium or in a memory of the recording and/or reproducing device. So, 
when the recording and/or reproducing device next reproduces and exploits the 
content, the content key can be calculated on decrypting the encrypted content key 
only once, thus eliminating the necessity for the recording and/or reproducing device 
to execute KRB decrypting processing each time the content is used. 

Meanwhile, the program furnishing medium according to the present invention 
is a medium for furnishing a computer program, in a computer readable form, to a 
general-purpose computer system capable of executing a variety of program codes. 
There is no particular limitation to the configuration of the media, including recording 
media, such as CD, FD or MO, or to the transmission medium, such as networks. 

The program furnishing medium gives a definition of the relationship as to 
structural or functional cooperation between the computer program and the furnishing 
medium in implementing the functions of the preset computer program on a computer 
system. Stated differently, by installing the computer program on the computer system 
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through the furnishing medium, cooperative actions can be realized on the computer 
system to realize the operations and effect similar to the other aspects of the present 
invention. 

Other objects, features and advantages of the present invention will become 
more apparent from reading the embodiments of the present invention with reference 
to the drawings. 

Brief Description of the Drawings 

Fig.l is a block diagram showing an illustrative structure of an information 
recording and/or reproducing device of the present invention. 

Figs.2A and 2B show data recording processing flow of the information 
recording and/or reproducing device of the present invention. 

Figs.3A and 3B show data reproduction processing flow of the information 
recording and/or reproducing device of the present invention. 

Fig.4 shows a tree structure for illustrating the encryption processing for a key, 
such as a media key, for the information recording and/or reproducing device of the 
present invention. 

Figs. 5 A and 5B show an instance of a key renewal block (KRB) used for 
distributing media keys to the recording and/or reproducing device according to the 
present invention. 

Fig. 6 shows an instance of distribution and an instance of decryption processing 
employing a key renewal block (KRB) for a media key in the information recording 
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and/or reproducing device. 

Fig.7 is a block diagram for illustrating the encryption processing in data 
recording processing employing a media key in the recording and/or reproducing 
device according to the present invention. 

Fig. 8 illustrates the generation of a key unique to a disc, usable in the 
information recording and/or reproducing device according to the present invention. 

Fig.9 shows an instance of generating and processing a key unique to a title, 
usable in the information recording and/or reproducing device according to the present 
invention. 

Fig. 10 shows an instance of generating and a block key, usable in the 
information recording and/or reproducing device according to the present invention. 

Fig. 1 1 is a block diagram for illustrating the decryption processing during data 
reproduction employing a media key in the information recording and/or reproducing 
device according to the present invention. 

Fig. 12 shows instances of distribution, decryption and key storage processing 
employing the key renewal block (KRB) of the media key in the information recording 
and/or reproducing device according to the present invention. 

Fig. 13 shows instances of distribution, decryption and key storage processing 
flow (instance 1) employing the key renewal block (KRB) of the media key in the 
infonnation recording and/or reproducing device according to the present invention. 

Fig. 14 shows instances of distribution, decryption and key storage processing 



Li) Lis jev^jl 'J" ifi. .,„ Ofe .1. ;suh± 

21 

flow (instance 2) employing the key renewal block (KRB) of the media key in the 
information recording and/or reproducing device according to the present invention. 

Fig. 1 5 shows instances of distribution, decryption and key storage processing 
employing the key renewal block (KRB) of the media key in the information recording 
and/or reproducing device according to the present invention. 

Fig. 16 shows instances of distribution, decryption and key storage processing 
flow employing the key renewal block (KRB) of the media key in the information 
recording and/or reproducing device according to the present invention. 

Fig. 17 shows instances of distribution, deciyption and key storage processing 
employing the key renewal block (KRB) of the media key in a modification of the 
information recording and/or reproducing device according to the present invention. 

Fig. 1 8 shows a tree structure for illustrating the encryption processing of a key, 
such as a content key, for the information recording and/or reproducing device 
according to the present invention. 

Figs.l9A and 19B show an instance of a key renewal block (KRB) used in 
distributing a key, such as content key, for the information recording and/or 
reproducing device according to the present invention. 

Fig.20 shows an illustrative data structure at the time of furnishing content and 
a content key for the information recording and/or reproducing device according to the 
present invention. 

Fig.21 shows instances of distribution, decryption and key storage processing 
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employing a key renewal block (KRB) of a content key in the information recording 
and/or reproducing device. 

Fig.22 shows instances of distribution, decryption and key storage processing 
employing a key renewal block (KRB) of a content key in the information recording 
and/or reproducing device according to the present invention. 

Fig.23 shows instances of content decryption and key storage processing flow 
(instance 1) employing a key renewal block (KRB) of a content key in the information 
recording and/or reproducing device according to the present invention. 

Fig.24 shows instances of content decryption and key storage processing flow 
employing a key renewal block (KRB) of a content key in the information recording 
and/or reproducing device according to the present invention. 

Fig.25 shows instances of content decryption and key storage processing 
employing a key renewal block (KRB) of a content key in the information recording 
and/or reproducing device according to the present invention. 

Fig.26 shows instances of distribution, decryption and key storage processing 
employing a key renewal block (KRB) of a content key in the information recording 
and/or reproducing device according to the present invention. 

Figs.27 A and 27B are flowcharts for illustrating copying controlling processing 
in data recording processing in the information recording and/or reproducing device 
according to the present invention. 

Figs.28A and 28B are flowcharts for illustrating the copying controlling 
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processing in data reproduction processing in the information recording and/or 
reproducing device according to the present invention. 

Fig.29 is a block diagram showing a structure of processing means in case data 
processing is executed by software in the information recording and/or reproducing 
device according to the present invention. 
Best Mode for Carrying out the Invention 

Referring to the drawings, the present invention is now explained in detail. 

Fig. 1 is a block diagram showing the structure of an embodiment of a recording 
and/or reproducing device 100 according to the present invention. The recording 
and/or reproducing device 100 includes an input/output I/F (interface) 120, an MPEG 
(Moving Picture Experts Group) codec 130, an input/output I/F (interface) 140 
inclusive of an A/D and D/A converter 141, encryption processing means 1 50, a ROM 
(read-only memory) 160, a CPU (central processing unit) 170, a memory 180 and a 
recording medium interface (I/F) 190 for a recording medium 195. These units are 
interconnected over a bus 110. 

The input/output I/F 120 receives digital signals forming various content, such 
as pictures, speech or programs, supplied from outside, to output the received signals 
over the bus 1 10. The input/output I/F 120 also receives digital signals over the bus 
110 to output the signals to outside. The MPEG codec 130 MPEG-decodes the 
MPEG-encoded data, supplied over the bus 110, to output the decoded data to the 
input/output I/F 140, while MPEG-encoding digital signals supplied from the 
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input/output I/F 140 to output the encoded signals over the bus 1 10. The input/output 
I/F 140 includes an A/D-D/A converter 141. The input/output I/F 140 receives analog 
signals, as content, supplied from outside, to A/D (analog/digital) convert the received 
analog signals into digital signals, which are output at the MPEG codec 130. The 
input/output 1/F 140 also D/A (digital/analog) converts digital signals from the MPEG 
codec 130 by the A/D-D/A converter 141 into analog signals, which are output to 
outside. 

The encryption processing means 1 50 is formed by, for example, a one-chip LSI 
(large scale integrated circuit), and encrypts or decrypts the digital signals, as content, 
supplied over the bus 110, to output the resulting data again over the bus 110. 
Meanwhile, the encryption processing means 150 is not limited to a one-chip LSI but 
may also be formed by various software and hardware combined together. The 
configuration as processing means by the software configuration will be explained 
subsequently. 

The ROM 160 memorizes a leaf keys, as device key inherent to each of plural 
recording and/or reproducing devices or to each of plural groups of recording and/or 
reproducing devices, and a node key as a device key co-owned by plural recording 
and/or reproducing devices or by plural groups of recording and/or reproducing device. 
The CPU 170 executes programs stored in a memory 180 to control e.g., the MPEG 
codec 130 and the encryption processing means 1 50. The memory 180 is e.g., a non- 
volatile memory for storing programs run by the CPU 170 or data required for 
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operation of the CPU 170. The recording medium interface 190 drives a recording 
medium 195, capable of recording and/or reproducing digital data, to read out or 
reproduce digital data from the recording medium 1 95 to output the so read-out digital 
data over the bus 1 10. The recording medium interface 190 also furnishes the digital 
data, provided over the bus 1 10, to the recording medium 195 for recording thereon. 
Meanwhile, the program and the device key may also be stored in the ROM 160 and 
in the memory 1 80, respectively. 

A modem 200 connects to an external device over a telephone network. For 
example, the modem 200 connects to a server, such as Internet service provider (ISP) 
for establishing a communication path with content distribution servers on the Internet. 

The recording medium 195 is a medium capable of memorizing digital data, 
including optical discs, such as DVD or CD, magneto-optical disc, magnetic disc, 
magnetic tape or a semiconductor memory, such as RAM. In the present embodiment, 
the recording medium 1 95 is removable with respect to the recording medium interface 
190. The recording medium 195 may also be enclosed in the recording and/or 
reproducing device 100. 

Referring to the flowcharts of Figs.2A, 2B, 3A and 3B, the data recording 
processing on the recording medium and the data reproducing processing from the 
recording medium, in the recording and/or reproducing device of Fig. 1 , are hereinafter 
explained. In recording the content of digital signals from outside on the recording 
medium 195, the recording processing in accordance with the flowchart of Fig.2A is 
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perfonned. That is, when the content of digital signals (digital content) are sent e.g. 
over an IEEE (Institute of Electrical and Electronics Engineers) 1394 serial bus to the 
input/output I/F 120, the input/output I/F 120 at step S201 receives the digital content, 
supplied thereto, to output the received digital content over the bus 110 to the 
encryption processing means 150. 

The encryption processing means 150 at step S202 executes the encryption 
processing on the digital content received to output the resulting encrypted content 
over the bus 1 10 to the recording medium interface 190. The encrypted content is 
recorded via recording medium interface 190 on the recording medium 1 95 (S203) to 
terminate the recording processing. 

As the standard for protection of digital content in case of transmitting the 
digital content between equipment interconnected over IEEE 1 394 serial bus, 5CDTCP 
(Five Company Digital Transmission Content Protection), incidentally referred to as 
DTCP, is provided by five companies inclusive of the Assignee company (SONY 
Corporation). In this DTCP, when non-copy-free digital content is transmitted 
between different devices, reciprocal authentication is perfonned prior to data 
transmission to make a check as to whether or not the copy control information, used 
for copy control, can be handled correctly. The transmission side then encrypts the 
digital content and sends the so encrypted content, with the receipt side then 
decrypting the encrypted digital content (encrypted content). 

In data transmission and reception, based on the DTCP standard, the 
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input/output I/F 120 on the data receipt side at step S201 receives the encrypted 
content over the IEEE 1394 serial bus to deciypt the encrypted content in accordance 
with the DTCP to output the resulting plaintext content subsequently to the encryption 
processing means 150. 

The encryption of the digital content by DTCP is executed by generating a key 
changing with time and by employing the so-generated key. The encrypted digital 
content, inclusive of the key used for encryption, is transmitted over the IEEE 1394 
serial bus. The receipt side decrypts the encrypted digital content, using the key 
contained therein. 

More correctly, according to DTCP, an initial value of the key and a flag 
indicating the change timing of the key used in encrypting the digital content is 
included in the encrypted content. The receipt side modifies the initial value of the 
key contained in the encrypted content with a timing of a flag similarly contained in 
the encrypted content to generate a key used for encryption to decrypt the encrypted 
content. However, this may be thought to be equivalent to the encrypted content 
containing a key for decryption. Therefore, in the following, this understanding is 
used. It should be noted that an information version of the DTCP standard can be 
acquired by any person from DTLA (Digital Transmission Licensing Administrator). 

The processing of recording the content of analog signals from outside on the 
recording medium 195 is now explained with reference to the flowchart of Fig.2B. 
When the content of the analog signals (analog content) are sent to the input/output 
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I/F 140, the input/output I/F 140 at step S221 receives the analog content. The 
input/output I/F 140 then proceeds to S222 to A/D convert the analog content by the 
enclosed A/D- D/A converter 141 to form content of digital signals (digital content). 

The digital content is sent to the MPEG codec 130. At step S223, the digital 
content is MPEG encoded, that is encoded by MPEG compression. The resulting 
encoded data is sent over the bus 1 10 to the encryption processing means 1 50. 

Subsequently, at steps S224 and S225, the processing similar to that performed 
at steps S202 and S203 of Fig.2A is performed. That is, the encryption processing by 
the encryption processing means 150 is executed and the resulting encrypted content 
is recorded on the recording medium 195. The recording processing is then 
terminated. 

The processing of reproducing the content recorded on the recording medium 
195 and outputting the reproduced content as digital or analog content is explained 
with reference to the flowcharts of Figs. 3A and 3B. The processing of outputting the 
content as digital content to outside is executed as the reproduction processing 
conforming to the flowchart of Fig. 3 A. That is, first, at step S301, the encrypted 
content, recorded on the recording medium 1 95, is read out by the recording medium 
interface 190, and output over the bus 1 10 to the encryption processing means 150. 

The encryption processing means 150 at step S302 decrypts the encrypted 
content, supplied from the recording medium interface 190, and the resulting 
decrypted data is sent over the bus 1 10 to the input/output I/F 120. At step S303, the 
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input/output I/F 1 20 outputs the digital content to outside to terminate the reproduction 
processing. 

In outputting the digital content over the IEEE 1394 serial bus, the input/output 
I/F 120 at step S303 undertakes authentication with a counterpart device, in 
accordance with the DTCP standard, as described above. The input/output I/F 120 
then encrypts and transmits the digital content. 

In reproducing the content recorded on the recording medium 195 and 
outputting the reproduced content as analog data to outside, the reproducing 
processing is executed in association with the flowchart of Fig.3B. 

That is, at steps S32 1 and S322, the processing similar to that in steps S301 and 
S302 is carried out, whereby the decrypted digital content, obtained by the encryption 
processing means 150, is sent over the bus 1 10 to the MPEG codec 130. 

The MPEG codec 130 at step S323 MPEG decodes, that is expands, the digital 
content, to output the expanded content to the input/output I/F 140. The input/output 
I/F 140 at step S324 D/A converts the digital content, MPEG decoded by the MPEG 
codec 130, by the enclosed A/D- D/A converter 141, to form analog content. The 
MPEG codec then proceeds to step S325 where the input/output I/F 140 outputs the 
analog content to outside to terminate the reproduction processing. 

The configuration of distributing keys necessary for the recording and/or 
reproducing device of Fig. 1 to record or reproduce data on or from the recording 
medium, for example, a master key or a media key, to respective equipment, is now 
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explained. The master key is a common key in the present system, owned in common 
by plural devices and recorded in the devices at the time of manufacture thereof. The 
master key is preferably common to all devices used in this key distribution system. 
The media key is a key proper to each recording medium and is recorded in the 
recording medium at the time of manufacture thereof. Ideally, the media key differs 
from one recording medium to another. However, from the constraint associated with 
the manufacturing process of the recording medium, the media key may more 
realistically be changed from one group made up of plural recording media to another. 
For example, the media key may be changed from one lot corresponding to a 
production lot of recording media as one group to another. The following description 
is centered about an instance of renewing these keys. However, the present invention 
may also be applied for distributing or recording these keys to or on a device not 
having a master key recorded or a recording medium not having a media key 
recorded. 

Fig.4 shows a key distribution configuration in a recording and/or reproducing 
device in a recording system employing the present system. The numbers 0 to 15 
shown in the bottom row of Fig.4 indicate respective recording and/or reproducing 
devices. That is, the respective leaves of the tree structure shown in Fig.4 correspond 
to the respective recording and/or reproducing devices. 

The respective devices 0 to 15 at the time of manufacture (shipment) include 
stored therein keys (node keys), assigned to nodes from own leaves to the root in a 
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predetermined initial tree, and leaf keys of the respective keys. K0000 to Kl 1 1 1, 
shown at the bottom of Fig.4, represent leaf keys assigned to the respective devices 0 
to 15, with the keys from the top key to the keys entered in second nodes from the 
bottom KR to Kl 1 1 being node keys. 

In the tree structure, shown in Fig.4, the device 0, for example, owns the leaf 
key K00OO and node keys K000, K00, KO and KR. The device 5 owns KO 10 1 , KO 1 0, 
KO 1 , KO and KR, while the device 1 5 owns K 1 1 1 1 , K 1 1 1 , K 1 1 , K 1 and KR. Although 
only 1 6 devices of 0 to 1 5 are indicated in the tree of Fig.4, with the tree configuration 
being of well-balanced left-right symmetrical structure in four rows, more devices 
may be entered in a tree, while the number of rows in the tree structure may differ 
from that shown therein. 

The recording and/or reproducing devices, included in the tree structure of 
Fig.4, are comprised of the recording and/or reproducing devices of variable types 
employing a variety of recording media, such as DVD, CD, MD or Memory Stick 
(trademark). Moreover, it may be presupposed that a variety of application services 
co-exist. The key distribution configuration shown in Fig.4 is applied to this 
presupposed co-existing configuration of different applications. 

In the system where these variable devices and applications co-exist, the 
portion surrounded by a dotted line in Fig.4, that is devices 0 to 3, is set as a group 
employing one and the same recording medium. For the devices belonging to this 
group, defined by the dotted line, processing operations, such as encrypting common 
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content to be forwarded from a provider, forwarding a master key used in common, 
or outputting payment data of content fee in a similarly encrypted form to a provider 
or to a settlement organization, may be executed at a time. The organization 
responsible for data transmission and reception to or from respective devices, such as 
the content providers or settlement organizations, execute the processing of forwarding 
data in a lumped fonn, with the portion surrounded by a dotted line in Fig.4, that is the 
devices 0 to 3, as a group. A plural number of such groups exist in the tree structure 
of Fig.4. 

It should be noted that the node and leaf keys may be supervised in a centralized 
fashion by a sole key management center, or on the group basis by the providers or 
settlement organizations transmitting or receiving a variety of data to or from the 
respective groups. In case of, for example, key leakage, the node or leaf keys are 
renewed by the key management center, provider or by the settlement organizations. 

As may be seen from Fig.4, the four devices 0 to 3 of one group own common 
keys K00, KO and KR as node keys. By exploiting this node key co-owning 
configuration, it becomes possible to furnish e.g., a common master key only to the 
devices 0 to 3. For example, if the co-owned node key K00 itself is set as a master 
key, a common master key can be set only for the devices 0 to 3 without executing new 
key forwarding operations. Moreover, if a value Enc (K00, Kmaster), obtained on 
encrypting a new master key Kmaster with the node key K00, is distributed over the 
network, or as it is stored on a recording medium, only the devices 0 to 3 are able to 
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decrypt the cipher Enc (KOO, Kmaster) to obtain the master key Kmaster. Meanwhile, 
Enc (Ka, Kb) indicate data obtained on encrypting Kb with Ka. 

If it is revealed at a certain time point / that the keys owned by the device 3, that 
is K0011, K001, KOO, KO and KR were analyzed by an aggressor (hacker) and 
disclosed, the device 3 subsequently needs to be separated from the system in order 
to protect data transmitted or received in the system (group of the devices 0 to 3). To 
this end, the node keys KOO 1 , KOO, KO and KR must be renewed to new keys K(t)00 1 , 
K(t)00, K(t)0 and K(t)R, respectively, while these renewed keys must be transmitted 
to the devices 0, 1 and 2. Meanwhile, K(t)aaa denotes that it is a renewed key of a 
key Kaaa with a generation : /. 

The processing of distributing a renewal key is explained. The renewal of a key 
is executed by storing a table formed by block data termed a key renewal block (KRB) 
shown for example in Fig.5A in a network or in a recording medium and by sending 
the table to the devices 0 to 2. 

The key renewal block (KRB), shown in Fig. 5 A, is fonned as block data of a 
data structure in which renewal is possible only for the devices in need of renewal of 
node keys. The block data shown in Figs. 5 A and 5B are fonned with a view to 
distributing a renewal node key of the generation 1 to the devices 0, 1 and 2 of the tree 
structure shown in Fig.4. As may be seen from Fig.4, the devices 0 and 1 are in need 
of K(t)00, K(t)0 and K(t)R, as renewal node keys, whilst the device 2 is in need of 
K(t)001, K(t)00, K(t)0 and K(t)R, as renewal node keys. 



,:i O LP iB-'gi .1. / nS m u 6 :i .3 Q£5 



34 

As shown in the KRB of Fig.5A, plural encrypted keys are contained in KRB. 
The encrypted key at the bottom row is Enc (K0010, K(t)OOl). This is a renewal node 
key K(t)001, encrypted by the leaf key K0010 owned by the device 2, so that the 
device 2 is able to decrypt the encrypted key by the device's own leaf key to obtain 
K(t)001. Moreover, using K(t)001, obtained on deciyption, the encrypted keys 
Enc(K(t)001, K(t)OO) in the second row from the bottom of Fig. 5 A can be decrypted 
to give the renewed node key K(t)00. In a similar sequence of operations, the 
encrypted keys Enc(K(t)00, K(t)O) in the second row from top of Fig. 5 A can be 
decrypted to give a renewed node key K(t)0, whilst the encrypted keys Enc(K(t)0, 
K(t)R) in the first row from top of Fig. 5 A can be decrypted to give K(t)R. As for the 
devices 0 and 1, the node key K000 is not to be renewed. It is only K(t)00, K(t)0 and 
K(t)R that are needed as renewal node keys. As for the devices 0 and 1 , the enciypted 
keys Enc(K000, K(t)OO) in the third row from the top of Fig. 5 A are decrypted to obtain 
K(t)00. Similarly, the encrypted keys Enc(K(t)00, K(t)O) in the second row from top 
of Fig. 5 A are decoded to give a renewal node key K(t)0 and the encrypted keys 
Enc(K(t)0, K(t)R) in the first row from top of Fig. 5 A are decrypted to give K(t)R. In 
this manner, the devices 0 to 2 are able to acquire the renewed keys K(t)R. 
Meanwhile, indices in Fig. 5 A denote absolute addresses of the node and leaf keys used 
as decoding keys. 

If renewal of the node keys K(t)0 and K(t)R in the topmost row of the tree 
structure shown in Fig.4 is unneeded, whilst only the renewal of the node ley K00 is 
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needed, the key renewal block (KRB) of Fig.5B may be used to distribute the renewal 
node key K(t)00 to the devices 0 to 2. 

The KRB shown in Fig.5B may be used in case a new master key to be co- 
owned by e.g., a specified group or a media key unique to a recording medium is to be 
distributed. As a specified instance, it is assumed that the devices 0 to 3 in the group 
shown by a dotted line in Fig.4 are using a certain recording medium, and that a new 
common master key K(t)master is needed. At this time, data Enc(K(t), K(t)master), 
obtained on encrypting a new common renewed master key K(t)master, using K(t)00, 
which is a renewed node key K00 common to the devices 0 to 3, is distributed along 
with the KRB shown in Fig.5B. By this distribution, distribution as data not decrypted 
by an equipment of the other group, such as device 4, becomes possible. The same 
may be said of the media key. 

That is, the devices 0 to 3 are able to decrypt the aforementioned cryptotext, 
using K(t)00 obtained on processing KRB to obtain the master key K(t)master or the 
media key K(t)media at a time point /. 

Fig.6 shows, as a processing instance of obtaining the media key K(t)media at 
a time point / as proposed in a senior patent application of the present Assignee (JP 
Patent Application 2000-105328), the processing of the device 2 which has received, 
through the recording medium, data Enc(K(t)00, K(t)media) which has encrypted the 
new common media key K(t)media using K(t)00, and the KRB shown in Fig.5B. 

It is assumed that, as shown in Fig.4, the four devices 0 to 3 encircled in a 
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dotted line are included in a certain recording and/or reproducing system. Fig.6 shows 
the processing in finding the media key needed for the recording and/or reproducing 
device (device 2) to encrypt or decrypt the content on the recording medium in case 
the device 3 is revoked and the media key assigned from one recording medium to 
another is used, with the aid of a key renewal block (KRB) and a device key 
memorized by the recording and/or reproducing device. 

In a memory of the device 2, there are safely stored the leaf key K0010, 
assigned only to itself, and node keys K001 , K00, KO and KR of the respective nodes 
001, 00, 0 and R from the leaf key up to the root of the tree. The device 2 has to 
decrypt the cryptotext with the index of 0010, in the KRB stored in the recording 
medium of Fig.6, with an own leaf key K0010, to calculate the node key K(t)001 of 
the node 001, to decrypt the cryptotext with the index 001, using the so calculated 
node key, to calculate the node key K(t) 00 of the node 00, and finally to decrypt the 
cryptotext with the index of 001, using the so calculated node key, to calculate the 
media key K(t)_media. The number of times of calculations is increased as the depth 
from the leaf to the node for encrypting the media key is increased. That is, 
voluminous calculations are needed in a large system where there exist a large number 
of recording and/or reproducing devices. The data encryption and decryption 
processing modes employing the so calculated and acquired media key are hereinafter 
explained. 

Referring to the processing block diagram of Fig.7, an instance of the data 
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encryption processing executed by the encryption processing means 150 and the 
recording and/or reproducing processing for a recording medium is explained. 

The recording and/or reproducing device 700 acquires the media key by the 
calculating processing based on the own KRB described above. 

The recording and/or reproducing device 700 checks whether or not a disc ID 
as the identification information has already been recorded on e.g., a recording 
medium 702 as an optical disc. If the disc ID has already been recorded, the disc ID 
is read out. If otherwise, a disc ID 1701 is generated by e.g., a random number 
generation method selected at random or predetermined at the encryption processing 
means 150. The disc ID 170 1 so generated is recorded on the disc. Since only one disc 
ID suffices for the disc, it may be stored e.g., in a lead-in area. 

The recording and/or reproducing device 700 then generates a disc unique key, 
using the media key 701 and the disc ID. As a specified method for generating the 
disc unique key, a method of an instance 1 employing the results obtained on inputting 
the media key and the disc ID to a hash function employing a block cipher function, 
as shown in Fig. 8, or a method of an instance 2 employing, as a disc unique key, only 
a needed data length from a 160-bit output, obtained on inputting data generated on 
bit concatenation of the media key and the disc ID to the hash function SHA-1, as 
defined in FIPS (Federal Information Processing Standards Publications) 180-1. 

Then, a title key, as a recording specific key, is generated in the encryption 
processing means 150 (see Fig.l) at random or by a predetermined method, such as 
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a random number generation, to record the so generated title key on the disc 702. 

From a combination of the disc unique key, title key and the device ID or a 
combination of the disc unique key, title key and the device unique key, a title unique 
key is generated. 

For generating the title unique key, there may be used the method of the 
instance 1 employing the results obtained on inputting the title key and the disc unique 
key, the device ID (in case of not limiting the reproducing equipment) or the device 
unique key (in case of limiting the reproducing key) to the hash function employing 
the block cipher function, as shown in Fig.9, or the method of the instance 2 
employing, as the title unique key, only a needed data length from a 160-bit output 
obtained on inputting data generated on bit concatenation of the media key, disc ID 
and the device ID (in case of not limiting the reproducing equipment) or the device, 
unique key (in case of limiting the reproducing key) to the hash function SHA-,1 as 
defined in FIPS 180-1. Meanwhile, limitation of the reproducing equipment means 
rendering reproduction of content data stored in the recording medium possible only 
in a specified reproducing device. 

In the foregoing explanation, the disc unique key is generated from the media 
key and the disc ID, and the title unique key is generated from the disc unique key, title 
key and the device ID or from the title key and the device unique key. Alternatively, 
the title unique key may directly be generated from the media key, disc ID, title key 
and the device ID or device unique key, without using the disc unique key. Still 
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alternatively, a key equivalent to the title unique key may be generated from the media 
key, disc ID and the device ID or the device unique ID, without using the title key. 

Referring to Fig.7, the ensuing processing is explained. From a block seed, 
corresponding to separated leading number 1 to number 4 bytes of the block data, 
input as data for encryption, and from the previously generated title unique key, a 
block key, as a key for encrypting the block data, is generated. 

Fig. 10 shows an instance of generating the block key. Fig. 10 shows two 
instances of generating a 64-bit block key from a 32 bit block seed and a 64 bit title 
unique key. 

The instance 1, shown on an upper side, uses a 64-bit cipher function, with a 
key length being 64 bits, for each of an input and an output. The block seed and a 32- 
bit constant, concatenated together, are input and encrypted, using the title unique key 
as a key for this cipher function, to form a block key as the result of the encryption. 

The instance 2 uses the hash function SHA-1 of FIPS 180-1. The title unique 
key and the block seed are concatenated together and input to the SHA- 1 and a 1 60-bit 
output thereof, contracted to 64 bits, such as by employing only lower 64 bits thereof, 
is used as the block key. 

In the foregoing, the instance of generating the disc unique key, title unique key 
and the block key has been explained. Alternatively, the block key may be generated 
using the media key, disc ID, title key, block seed and the device ID or the device 
unique key may be used from block to block to generate the block key, without 
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generating the disc unique key or the title unique key. 

When the block key is generated, block data are encrypted, using the so 
generated block key. As shown in the bottom part of Fig.7, the leading number 1 to 
number m bytes of the block data, inclusive of the block seed, m being, for example, 
8, are separated (selector 1 608), without being encrypted, while the number m+1 data 
up to the trailing data are encrypted. Meanwhile, the number 1 to number 4 bytes, as 
the block seed, are included in the non-encrypted m bytes. The block data as from the 
number m+1 byte, separated by the selector, are encrypted in accordance with the 
encryption algorithm preset on the encryption processing means 150. As the 
encryption algorithm, the DES (data encryption standard) provided for in, for example, 
FIPS 46-2, may be used. 

By the above processing, the content is encrypted, on the block basis, by a block 
key generated based on the generation-managed media key or block seed, so as to be 
stored in the recording medium. 

Fig. 1 1 shows a block diagram showing the processing of decrypting encrypted 
content data stored in the recording medium and of reproducing the so deciypted data. 

In the reproducing processing, as in the encryption and recording processing 
explained with reference to Figs. 7 to 10, a disc unique key is generated from the media 
key and the disc ID, a title unique key is generated from the disc unique key and the 
title key, and the block key is generated from the title key and the block seed as read 
out from the recording medium. The block-based encrypted data, read out from the 
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recording medium 702, is decrypted, using the block key as the decrypting key. 

In the enciyption processing in recording content data on a recording medium 
and in the decryption processing in reproducing the content data from the recording 
medium, as described above, a media key is calculated based on the KRB. The key 
for encrypting or decrypting the content then is generated based on the so calculated 
media key or other identifiers. 

In the above-described instance, the configuration of generating a key used for 
encrypting or decrypting the content data has been explained. Alternatively, the key 
used for encrypting and decrypting the content key may also be generated based not 
on the media key but on a master key common to the plural recording and/or 
reproducing devices or a device key unique to the recording and/or reproducing device, 
acquired from the KRB. The media key, master key or the device key per se, as 
acquired from the KRB, may also be applied as keys used for encrypting and 
decrypting the content data. 

In these configurations, the device is requested to calculate the encrypted key 
required for encrypting or decrypting data, or data for generating the encrypted key, 
as needed in encrypting or decrypting data, by a plural number of decrypting 
processing operations, during recording or reproducing data, based on the KRB stored 
in the recording medium of Fig.6. The number of times of the calculations, needed for 
this KRB processing, is increased with increasing depth from the leaf to the node for 
which the media key is encrypted. That is, the volume of calculations is increased for 



,:l lp O & ./ „. o ft :i :s o e 

# # 

42 

a system including a large number of recording and/or reproducing devices. 

Fig. 12 shows the configuration of handling the media key of the recording 
and/or reproducing device, designed for facilitating these processing operations, 
according to the present invention. In the configuration of the present invention, the 
processing is similar to that of Fig.6 up to calculations by the recording and/or 
reproducing device of the media key from the KRB stored in a recording medium. In 
the present invention, the media key is encrypted using a key known only to the device 
in question, or a key unique to the recording and/or reproducing device, such as a leaf 
key assigned only to the device in question in the tree structure, and is recorded in an 
area provided at the outset in a recording medium, along with the identification 
information of the recording and/or reproducing device, such as, for example, the leaf 
number assigned to the recording and/or reproducing device. The device 12 of Fig. 12 
encrypts the media key K(t)media, acquired by KRB processing, with the own leaf key 
K00 1 0, to store it in a recording medium. 

In this manner, when the media key acquired by plural stages of the decryption 
processing of the KRB is again used, it can be acquired by a simple decryption 
processing, without newly executing plural stages of decoding processing. That is, 
if the same recording and/or reproducing device accesses this recording medium a 
second time, a third time and so on, the media key can be obtained by decrypting the 
cryptotext stored in the media key storage table, with an own unique key, without the 
necessity of executing voluminous calculations using the KRB. Moreover, since the 
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encrypted media key stored in the recording device can be decrypted using only the 
leaf key unique to the device 2, the encrypted media key cannot be acquired on 
decryption even if the recording medium is loaded on another different device. 

The flow for acquiring the media key when the recording and/or reproducing 
device according to the present invention accesses a recording medium, that is when 
the recording medium is loaded on the recording and/or reproducing device, is shown 
in Fig. 13. The processing flow of Fig. 1 3 is now explained. 

At step SI 301, the recording and/or reproducing device reads out a media key 
storage table recorded on the recording medium. At step S 1302, the recording and/or 
reproducing device checks the index part of the media key storage table to inspect 
whether or not there is the leaf number assigned to it, that is whether or not there is 
data it stored. If there is no such data, the recording and/or reproducing device 
proceeds to SI 303 and, if otherwise, to step S1309. 

At step S 1 303, the recording and/or reproducing device reads out the KRB (key 
renewal block) from the recording medium. At step SI 304, the recording and/or 
reproducing device calculates the key K(t) of the node 00 at the KRB of the 
identification number: generation (/ in Fig.7), using the KRB read out at step S1303, 
the leaf key it has stored in the memory (K0010 in the device 2 of Fig.4) and the node 
keys (K001, K00, - in the device 2 of Fig.4). 

At step SI 305, a value corresponding to an encrypted representation of the 
media key K(t)media is read out from the recording medium, using Enc(K(t)00, 
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K(t)media), that is K(t)00. 

At step SI 306, this cryptotext is decoded, using K(t)00, to calculate K(t)media. 
The so calculated media key is used for encryption and decryption in recording and/or 
reproducing data for the recording medium. 

At step S 1307, the media key K(t)media is encrypted, using the leaf key which 
only the device in question owns (K0010 of device 2 of Fig.4). 

At step S 1 308, the cryptotext prepared at step S 1 307 and the number of the leaf 
key (leaf number) 0010, as the own identification information, are recorded on the 
media key storage table of the recording medium to terminate the processing. 

If, at step SI 302, the cryptotext stored in the recording and/or reproducing 
device itself is found in the media key storage table, the device moves to step SI 309 
to read out the cryptotext from the recording medium. 

At step S1310, the device deciypts the cryptotext, using its own leaf key, to 
acquire the media key for the recording medium. This media key is used for 
encryption and decryption at the time of recording and reproduction of data to or from 
the recording medium. 

In the above processing, the processing of steps S1307 and SI 308 may be 
executed only when a set of the indexes and the cryptotext can be newly written in the 
media key storage table, as shown in Fig. 14. 

In Fig. 14, the steps SI 301 to SI 306 and SI 307 to S 13 10 are similar to those in 
Fig. 1 3 and hence are not explained specifically. 
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At step S 140 1, the recording and/or reproducing device verifies whether or not 
there is any space left for recording by it in the media storage cable. If there is any 
space left, the program moves to step SI 307 and the cryptotext is recorded at step 
S 1 308 on the table. If there is no space, the processing of steps S 1 307 and S 1 308 are 
skipped to terminate the processing. 

In the above-described embodiments, the tables used by respective recording 
and/or reproducing devices are placed in the respective recording media, as explained 
previously with reference to Fig. 12. In the present embodiment, the media keys 
specific to the respective recording media are stored, as shown in Fig. 15, in the 
respective recording an d/or reproducing devices, such as memory 1 80 in the recording 
and/or reproducing device 1 00 shown in Fig. 1 . 

In storing the encrypted media keys in the memory 1 80 of the recording and/or 
reproducing device 100, such a media key storage table is used, in which encrypted 
media keys are associated with one another with the media key generation information 
as the index. This takes into account a case of storing the media key of plural media 
keys of different generations. 

Fig. 1 6 shows the flow for acquiring media keys when the recording and/or 
reproducing device of the present embodiment accesses the recording medium, that 
is when the recording medium is loaded on the recording and/or reproducing device. 

At step SI 601, the recording and/or reproducing device reads out the KRB 
generation (t in the instance of Fig. 15) as an identification number of the media key 
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from the recording medium. 

At step S 1602, the recording and/or reproducing device inspects whether or not 
the media key having the generation equal to / is stored in the media key storage table 
the device itself holds. If such media key is not stored, the recording and/or 
reproducing device proceeds to step S1603 and, if otherwise, to step SI 6 10. 

The processing of steps S1603 to S1606 is similar to that of S130 1 to 1306 of 
Fig. 13, respectively, and hence is not explained. By this processing, the recording 
and/or reproducing equipment acquires a media key. The so calculated media key is 
used for encryption and decryption at the time of recording and reproduction. 

At step SI 607, the recording and/or reproducing equipment checks whether or 
not there is any space for storage of a new media key in the media key storage table of 
own recording means. If there is any space, the recording and/or reproducing 
equipment proceeds to step SI 608 and, if otherwise, skips the processing of steps 
S1608 and S1609. 

At step S 1 608, as at step S 1 307 of Fig. 1 3, the equipment encrypts the media key 
using its own leaf key. At step S1609, the cryptotext is stored in the media key storage 
table along with the identification information: generation. 

At step S1602, if the cryptotext corresponding to the generation is found in the 
media key storage table, the recording and/or reproducing equipment proceeds to step 
S 16 10 to read out the cryptotext from the media key storage table. At step S 1 6 1 1 , as 
at S1310 of Fig. 13, the recording and/or reproducing equipment decrypts the 
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cryptotext, using its own leaf key, to acquire the media key of the recording medium. 
This media key is used for data encryption and decryption in recording and 
reproducing the data on or from the recording medium. 

In the above-described embodiment, the own key is used for encryption in 
storing the media key in the media key storage table. However, if safe recording may 
be made without the content of the media key storage table becoming disclosed to 
outside, encryption is not mandatory. That is, it suffices if the media key K(t)media 
obtained on decrypting the KRB is stored directly, that is without encryption, in 
association with the generation as the index, as shown in Fig. 17. If, in this case, the 
media key K(t)media is re-used, the processing of decryption is unnecessary. 

The above-described embodiments may also be combined such that the media 
key storage table is owned by both the recording medium and the recording and/or 
reproducing equipment. 

In the above instance, the key acquired based on the KRB processing has been 
explained as a media key. This method, however, is not specific to the media key, and 
may, of course, be applied to a master key stored in common in plural equipment or 
to a device key unique to an individual equipment. 

In the above instance, the expression key renewal block (KRB) is used for 
explaining data used for distributing the keys. It should however be apparent from the 
foregoing description that the key renewal block is not limited to key renewal but may 
be applied in general to key distribution at large. 
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The configuration in which the recording and/or reproducing equipment shown 
in Fig. 1 distributes keys, such as a content key, required in recording or reproducing 
data on or from the recording medium, to respective equipment, is explained. 
Meanwhile, the content key is a key used for decrypting the encrypted content 
distributed over the communication medium or through a recording medium. Fig. 1 8 
shows the key distribution configuration in the recording and/or reproducing 
equipment in the recording system employing the present system. The numbers 0 to 
15 shown at the bottom row in Fig. 18 represent respective recording and/or 
reproducing equipment. That is, the respective leaves of the tree structure shown in 
Fig. 18 correspond to the respective recording and/or reproducing devices. 

In the respective devices 0 to 15, there are stored, at the time of manufacture 
(shipment), the keys (node keys), allocated to respective nodes from the own leaf to 
the root in the preset initial tree, and the leaf keys of the respective leaves. K0000 to 
Kllll shown at the bottom row of Fig. 18 represent leaf keys allocated to the 
respective devices 0 to 15, with the keys KR to Kl 1 1 as from the topmost row KR to 
the second node as from the bottom row being node keys. 

In the tree structure shown in Fig. 18, the device 0, for example, owns the leaf 
key K0000 and the node keys KO00, K00, K0 and KR. The device 1 5 owns Kllll, 
Kl 1 1 , Kl 1 , Kl and KR. Although only 1 6 devices of 0 to 1 5 are indicated in the tree 
of Fig.4, with the tree configuration being of well-balanced left-right symmetrical 
structure in four rows, more devices may be indicated in a tree, while the number of 
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rows in the tree structure may differ from that shown therein. 

The recording and/or reproducing devices, included in the tree structure of 
Fig. 1 8, are comprised of the recording and/or reproducing devices of variable types 
employing a variety of recording media, such as DVD, CD, MD or Memory Stick 
(trademark). Moreover, it may be presupposed that a variety of application services 
co-exist. The key distribution configuration shown in Fig. 18 is applied to this 
presupposed co-existing configuration of different applications. 

In the system where these variable devices and applications co-exist, the 
portion surrounded by a dotted line in Fig. 18, that is devices 0 to 3, is set as one group 
employing one and the same recording medium. For the devices belonging to this 
group, defined by the dotted line, processing operations, such as encrypting common 
content to be forwarded from a provider, forwarding a master key used in common, or 
outputting payment data of content fee in a similarly encrypted form to a provider or 
to a settlement organization, may be executed at a time. The organization responsible 
for data transmission and reception to or from respective devices, such as the content 
providers or settlement organizations, execute the processing of forwarding data in a 
lumped form, with the portion surrounded by a dotted line in Fig. 1 8, that is the devices 
0 to 3, as a group. A plural number of such groups exist in the tree structure of Fig. 1 8. 

It should be noted that the node and leaf keys may be supervised in a 
concentrated fashion by a sole key management center, or on the group basis by the 
providers or settlement organizations transmitting or receiving a variety of data to or 
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from the respective groups. In case of, for example, key leakage, the node or leaf keys 
are renewed by the key management center, provider or by the settlement 
organizations. 

As may be seen from Fig. 1 8, the four devices 0 to 3 of one group own common 
keys K00, K0 and KR as node keys. By exploiting this node key co-owning 
configuration, it becomes possible to furnish e.g., a common master key only to the 
devices 0 to 3. For example, if the co-owned node key K00 itself is set as a master 
key, a common master key can be set only for the devices 0 to 3 without executing new 
key forwarding operations. Moreover, if a value Enc (K00, Kcontent), obtained on 
encrypting a new content key Kcontent with a node key K00, is distributed over the 
network or as it is stored on a recording medium, only the devices 0 to 3 are able to 
decrypt the cipher Enc (K00, Kcontent) to obtain the content key Kcontent. 
Meanwhile, Enc (Ka, Kb) indicate data obtained on encrypting Kb with Ka. 

If it is revealed at a certain time point t that the keys owned by the device 3, that 
is K0011, K001, K00, K0 and KR were analyzed by an aggressor (hacker) and 
disclosed, the device 3 subsequently needs to be separated from the system in order to 
protect data transmitted or received in the system (group of the devices 0 to 3). To this 
end, the node keys K001, K00, K0 and KR must be renewed to new keys K(t)001, 
K(t)00, K(t)0 and K(t)R, respectively, while these renewed keys must be transmitted 
to the devices 0, 1 and 2. Meanwhile, K(t)aaa denotes that it is a renewed key of a key 
Kaaa with a generation : /. 
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The processing of distributing a renewal key is explained. The renewal of a key 
is executed by storing a table formed by block data termed a key renewal block (KRB) 
shown for example in Fig. 19A in a network or in a recording medium and sending the 
table to the devices 0 to 2. 

The key renewal block (KRB), shown in Fig. 1 9A, is formed as block data of a 
data structure in which renewal is possible only for the devices in need of renewal of 
node keys. The block data shown in Figs. 19A are formed with a view to distributing 
a renewal node key of the generation / to the devices 0, 1 and 2 of the tree structure 
shown in Fig. 18. As may be seen from Fig. 18, the devices 0 and 1 are in need of 
K(t)00, K(t)0 and K(t)R, as renewal node keys, whilst the device 2 is in need of 
K(t)001, K(t)00, K(t)0 and K(t)R, as renewal node keys. 

As shown in the KRB of Fig. 19 A, plural encrypted keys are contained in KRB. 
The encrypted key at the bottom row is Enc (K00 10, K(t)00 1 ). This is a renewed node 
key K(t)001, encrypted by the leaf key K0010, owned by the device 2, so that the 
device 2 is able to decrypt the encrypted key by the device's own leaf key to obtain 
K(t)001. Moreover, using K(t)001, obtained on decryption, the encrypted keys 
Enc(K(t)00 1 , K(t)00) in the second row from the bottom of Fig. 19A can be decrypted 
to give the renewed node key K(t)00. In a similar sequence, the encrypted keys 
Enc(K(t)00, K(t)0) in the second row from top of Fig. 19A can be decrypted to give a 
renewed node key K(t)0, whilst the encrypted keys Enc(K(t)0, K(t)R) in the first row 
from top of Fig. 19A can be decrypted to give K(t)R. As for the devices 0 and 1, on 
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the other hand, the node key K000 is not to be renewed. It is only K(t)00, K(t)0 and 
K(t)R that are needed as renewal node keys. As for the devices 0 and 1 , the enciypted 
keys Enc(K000, K(t)00) in the third row from the top of Fig.l9A are decrypted to 
obtain K(t)00. Similarly, the encrypted keys Enc(K(t)00, K(t)O) in the second row 
from top of Fig. 19A are decoded to give a renewal node key K(t)0 and the encrypted 
keys Enc(K(t)0, K(t)R) in the first row from top of Fig.l9A are decrypted to give 
K(t)R. In this manner, the devices 0 to 2 are able to acquire the renewed keys K(t)R. 
Meanwhile, indices in Fig.l9A denote absolute addresses used as decoding keys. 

If renewal of the node keys K(t)0 and K(t)R in the topmost row of the tree 
structure shown in Fig. 18 is unneeded, whilst only the renewal of the node ley K00 is 
needed, the key renewal block (KRB) of Fig. 19B may be used to distribute the renewal 
node key K(t)00 to the devices 0 to 2. 

The KRB shown in Fig. 19B may be used in case a content key co-owned by a 
specified group, a master key or a media key unique to a recording medium is to be 
distributed. As a specified instance, it is assumed that the devices 0 to 3 in the group 
shown by a dotted line in Fig. 18 need to be supplied with the content encrypted using 
the content key and with the encrypted content key K(s)content, where s is a content 
ID for identifying the content. At this time, data Enc(K(t), K(s)content), obtained on 
encrypting a common node key K(s)content using K(t)00, which is a renewed node key 
K00 common to the devices 0 to 3, is distributed along with KRB shown in Fig. 19B. 
By this distribution, distribution as data not decrypted by an equipment of the other 
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group, such as device 4, becomes possible. The same may be said of other keys, such 
as media key. 

That is, the devices 0 to 3 are able to decrypt the cryptotext, using K(t)00 
obtained on processing KRB, to obtain the content key K(s)content or the media key 
K(t)media at a time point /. 

If the content, such as music data, encrypted with the content key, is furnished 
to the information recording and/or reproducing equipment arranged at the respective 
leaves of the tree structure as the above-described key distribution configuration, the 
data structure is as shown in Fig.20. 

The data is comprised of a key distributing portion and a content data portion, 
as shown in Fig.20. The key distributing portion has the above-described key renewal 
block (KRB) and a content key K(s)content encrypted by a renewal node key obtained 
by the processing of the key renewal block (KRB). The content data portion has stored 
therein content Enc(K(s)content, Content) as encrypted by the content key 
K(s)content. 

The information recording and/or reproducing equipment, that is able to acquire 
updated node keys by the processing of the key renewal block (KRB) as described 
above, can be set in many ways. If the configuration of furnishing the encrypted 
content, shown in Fig.20, is used, it is possible to provide the content that can be 
decrypted only by a specified information processing device. 

Fig.2 1 shows, as a processing instance of utilizing the content encrypted by the 
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content ID = s content key K(s) content, as proposed in out senior application JP 
Patent Application 2000-105329, the processing of the device 2 comprised of 
processing KRB with K0010 to acquire content key K(s) content to acquire the 
content from the encrypted data Enc(K(s) content, content). 

It is assumed that a certain recording and/or reproducing system includes four 
devices 0 to 4 surrounded by a dotted line, as shown in Fig. 18. The processing of data 
received by the recording and/or reproducing device (device 2) in case of using the 
content key K(s) with the device 3 revoked, that is the processing of finding the 
content key K(s) content based on the key renewal block (KRB) stored in a recording 
medium, is shown in Fig.21. 

In the memory of the device 2, there are safely stored the leaf key K0010 
allocated to the device 2 itself and node keys for nodes 001, 00, 0, R (K001, K00, K0 
and KR), from the leaf key K0010 to the root of the tree. The device 2 decrypts the 
cryptotext with the index of 0010 from the KRB stored in the recording medium of 
Fig.21, with the own leaf key K0010, to calculate the node key K(t)001 of the node 
001. Then, using the so calculated node key K(t)001, the device 2 decrypts the 
cryptotext, with the index of 001, to calculate the node key K(t)00 of the node 00. 
Then, using the so calculated node key, the device 2 decrypts the cryptotext, with the 
index of 00, to calculate K(t)0 of the node 0 and finally decrypts the cryptotext with 
the index 0, to calculate the node key K(t)R of the node R. Then, using the node key 
K(t)R, the device 2 decrypts Enc(K(t)R, K(s) content) to acquire the content key K(s) 
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content with the content ID = 0. 

Using the so acquired content key K(s) content, the encrypted content Enc: 
Enc(K(s), Content, stored in the content data portion, is decrypted to acquire the 
content. 

The deciyption processing of the encrypted content becomes possible by 
executing all of these processing steps. For the processing of acquiring the renewal 
node key by the processing of the key renewal block (KRB) as described above, it is 
necessary to repeat the similar decrypting operations a number of times. The number 
of times of the calculations, needed in the for this KRB processing, is increased with 
increasing depth from the leaf to the node with the encrypted content key. That is, the 
volume of calculations is increased for a system including a large number of recording 
and/or reproducing device. 

In reproducing the content in the information recording and/or reproducing 
device, it is necessary to calculate the content key by a plural number of decrypting 
operations based on the KRB stored e.g., in the recording medium. For example, if the 
content key is set as a key different from one content to another, the aforementioned 
KRB processing needs to be executed each time the content is reproduced. 

Fig. 2 2 shows a configuration for handling the content key of the recording 
and/or reproducing device of the present invention for relieving the processing load. 
The configuration of the present invention is similar to the processing of Fig.21 up to 
calculations of the content key by the recording and/or reproducing device. In the 
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present invention, the content key is encrypted using a key known only to the device 
in question, a key unique to the recording and/or reproducing device, such as a leaf key 
assigned only to the device in question in the tree structure, and is recorded in an area 
provided at the outset in a recording medium along with the identification information 
of the recording and/or reproducing device, such as, for example, the leaf number 
assigned to the recording and/or reproducing device. In the case of the device 2, as an 
example, as shown in Fig.22, the content key Enc(K0010, K(s) content), encrypted 
using the leaf key, is stored in the recording medium in a content key storage table as 
a set with the corresponding content. 

By employing the storage configuration of the content key storage table, 
described above, the content key can be acquired solely by the simple decoding 
processing, in case of re-using the content key acquired by plural stages of the KRB 
decryption processing, without the necessity of executing the plural stages of the 
decrypting processing anew. That is, if the same recording and/or reproducing device 
accesses the recording medium a second time, a third time and so on, the content key 
can be acquired by decrypting the cryptotext stored in the content key storage table 
with the own unique key without the necessity of executing voluminous calculations 
with the KRB. Moreover, since the encrypted content key, stored in the device, can 
be decrypted using only the leaf key unique to the device, the encrypted content cannot 
be decrypted and acquired in this fonn even if the recording medium is loaded on any 
other device. 
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Fig.23 shows the flow of the processing of loading a recording medium on a 
recording and/or reproducing device, acquiring the encrypted content key and 
encrypting and reproducing the content for exploiting the content. The processing 
flow of Fig.23 is now explained. Although the following explanation is made in 
connection with reproduction of content from a recording medium, the same holds 
when the content is acquired from a communication medium. 

At step S70 1 , the recording and/or reproducing device reads out the content key 
storage table, recorded along with the content recorded on the recording medium. 

At step S702, the recording and/or reproducing device checks the index part of 
the content key storage table to see whether or not there is the leaf number allocated 
to the device itself, that is whether or not there is data stored in the device itself. If 
there is no such data, program moves to step S703 and, if otherwise, to step S710. 

At step S703, the recording and/or reproducing device reads out the key renewal 
block (KR_B) from the recording medium. At step S704, the recording and/or 
reproducing device calculates the key of the node R in the KRB of the identification 
number: content ID (ts in Fig.22) of the content about to be reproduced by the device 
itself (root key K(t)R), using the KRB read out at step S703, the leaf key the device 
itself holds in the memory (K0010 in the device 2 of Fig. 18) and the node key (K00I, 
K00, • ) in the device of Fig. 18. Meanwhile, in the present instance, the content key 
is furnished as it is encrypted by the root key K(t)R. If the renewal node key K(t)xx 
is set, using the node key of the lower in order than the root key, the content key is 
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encrypted by the renewal node key K(t)xx and a content key that can be decrypted only 



by the specified group is distributed, the renewal node key can be found on 
calculations. 

At step S705, the encrypted value of the content key K(s) content is read out 
from Enc(K(t)R, K(s) content), using Enc(K(t)R, K(s) content), that is K(t)R. 

At step S706, this cryptotext is decrypted, using K(t)R, to calculate K(s) 
content. At step S707, the recording and/or reproducing device checks whether or not 
there is left any space in the content key storage table of the content on the recording 
medium to be recorded by the device itself. If there is any space left, the program 
moves to step S708 and, if otherwise, the program skips the processing at steps S708 
and S709 to proceed to step S712. 

At step S708, the device encrypts the content key K(s) content, using the leaf 
key owned solely by the device itself (K00 10 in the case of the device 2 of Fig. 18). 

At step S709, the cryptotext created at step S708 and the number of the leaf key 
(leaf number) which is to become the identification infonnation of the device itself 
(0010 with the device 2 of Fig. 18). The program then moves to step S712. 

If, at step S702, the cryptotext stored in the device itself is found in the content 
key storage table, the program moves to step S710 where the recording and/or 
reproducing device reads out the ciphertext from the recording medium. 

At step S7 1 1 , the recording and/or reproducing device decrypts the cryptotext, 
using the own leaf key, to acquire the content key of the content. The program then 
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moves to step S712 where the recording and/or reproducing device reads out the 
content data portion from the recording medium to decrypt it with the content key 
acquired at steps S706 or S71 1 to acquire plaintext data which is to be used. 

By so doing, it is possible to diminish the processing of calculating the content 
key with KRB each time the content is used. 

In recording the content on the recording medium, the content shown in Fig.20, 
transmitted or sent over the communication medium or via recording medium, that is 
the content data portion and the key distributing portion, are simply recorded on the 
recording medium. At this time, the processing of steps S701 to S709 is carried out 
in the same way as the content reproduction processing of Fig.23 . The processing flow 
in this case is shown in Fig.24. 

For recording the content of Fig.24, the processing similar to that executed at 
the time of reproducing the content of Fig.23 is executed. At step S801, the recording 
and/or reproducing device reads out the content key storage table as recorded on the 
recording medium. 

At step S802, the recording and/or reproducing device checks the index part of 
the content key storage table to see whether or not there is the leaf number allocated 
to the device itself, that is whether or not there is data the device itself has stored. If 
there is no such data, program moves to step S803 and, if otherwise, to step S812. 

At step S803, the recording and/or reproducing device reads out the key renewal 
block (KRB) from the recording medium. At step S804, the recording and/or 
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reproducing device calculates the key of the node R in the KRB of the identification 
number: content ID (s in Fig.22) of the content, using the KRB read out at step S803, 
the leaf key the device itself holds in the memory (K0010 in the device 2 of Fig. 18) 
and the node keys (K001 , K00, •••) in the device of Fig. 1 8, that is the root key K(t)R. 

At step S805, the an encrypted value of the content key K(s) content is read out 
from Enc(K(t)R, K(s) content), using Enc(K(t)R, K(s) content), that is K(t)R. 

At step S806, this cryptotext is decrypted, using K(t)R, to calculate K(s) 
content. At step S807, the recording and/or reproducing device checks whether or not 
there is left any space to be recorded by the device itself in the content key storage 
table of the content on the recording medium. If there is any space left, the program 
moves to step S808 and, if otherwise, the program skips the processing at steps S808 
and S809 to proceed to step S812. 

At step S808, the device encrypts the content key K(s) content, using the leaf 
key owned solely by the device itself (K00 10 in the case of the device 2 of Fig. 18). 

At step S809, the cryptotext created at step S808 and the number of the leaf key 
0010 (in the case of the device 2 of Fig. 18), which is to become the identification 
infonnation of the device itself, are recorded in the content key storage table of the 
recording medium. The program then moves to step S812. 

If, at step S802, the cryptotext the device itself has stored is found in the content 
key storage table, the program moves to step S812 to skip S803 to S809. 

At step S812, the content transmitted or sent over the communication medium 
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or via recording medium, that is the content data portion and the key distributing 
portion, encrypted with the content key K(s) content, are directly stored on the 
recording medium. Although the content is stored last time in the present instance, 
the content is previously encrypted, as shown in Fig.20, so that the content may be 
recorded in the recording medium before step S80 1 , that is the content storage may be 
performed at any desired time. 

By encrypting the content key at the time of data recording by a key unique to 
the device itself, for example, the leaf key, the processing of calculating the content 
key using the KRB when the recording and/or reproducing equipment subsequently 
uses the content can be decreased appreciably. 

In the above-described embodiments, the tables used by respective recording 
and/or reproducing devices are placed along with the content in the respective 
recording media, as explained in Fig.22. In the present embodiment, as shown in 
Fig.25, the content keys are stored in the respective recording and/or reproducing 
devices, such as in a memory 1 80 of a recording and/or reproducing device 1 00 shown 
in Fig. 1 . 

In storing the encrypted media keys in the memory 180 of the recording and/or 
reproducing device 100, such a storage key storage table is used, in which encrypted 
media keys are associated with one another with the media key generation information 
as the index. This takes into account the case of storing the content keys of plural 
different content IDs. 
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Fig.26 shows the flow for deciypting and reproducing the encrypted content in 
case the recording and/or reproducing device of the present embodiment uses the 
content, with the recording medium holding the encrypted content then being loaded 
on the recording and/or reproducing device, on the same premises as the above- 
described embodiments. 

At step S 1001, the recording and/or reproducing device reads out the content 
ID 0 in the instance of Fig.25), as an identification number of the content the device 
undertakes to reproduce, from the recording medium. 

At step S 1 002, the recording and/or reproducing device inspects whether or not 
the content key having the content ID equal to s is stored in the content key storage 
table held by the device itself. If such media key is not stored, the recording and/or 
reproducing device proceeds to step S1003 and, if otherwise, to step S1010. 

The processing of steps S1003 to S1006 is similar to that of S703 to 706 of 
Fig.23, respectively, and hence is not explained specifically. By this processing, the 
recording and/or reproducing equipment acquires the content key. 

At step SI 007, the recording and/or reproducing equipment checks whether or 
not there is any space for storage of a new content key in the content storage table of 
own recording means. If there is any space, the recording and/or reproducing 
equipment proceeds to step S1008 and, if otherwise, skips the processing of steps 
S1008 and SI 009. 

At step S 1 008, as at step S708 of Fig.23, the equipment encrypts the content key 
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using its own leaf key. At step SI 009, the cryptotext is stored in the content key 
storage table along with the content ID as the identification information. The program 
then moves to step S1012. 

If the cryptotext corresponding to the content ID is found at step SI 002 in the 
content key storage table, the recording and/or reproducing device proceeds to step 
S 10 10 to read out the ciyptotext from the content key storage table. At step S101 I, 
as at step S711 of Fig.23, the recording and/or reproducing equipment decrypts the 
cryptotext, using the own leaf key, to acquire the content key of the content. The 
recording and/or reproducing device then proceeds to step S1012. 

At step S1012, as at step S712 of Fig.23, the recording and/or reproducing 
device reads out the content data portion from the recording medium and proceeds to 
decrypt the encrypted content, using the content key obtained at steps S 1 006 or S 1 0 1 1 , 
to acquire the plaintext data of the content, such as music data. 

In the above-described embodiment, the own leaf key is used for encryption in 
storing the content key in the content key storage table. However, if safe recording 
may be made without the content of the content key storage table becoming disclosed 
to outside, encryption is not mandatory. Although the content key encrypted using the 
own leaf key is stored in the above instance in the content key storage table, in 
exploiting the content, the content key may be used in storing the content on the 
recording medium and the content key used for encryption may be stored in the 
content key storage table, as described above. 
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The above-described embodiments may also be combined such that the content 
key storage table is owned by both the recording medium and the recording and/or 
reproducing equipment. 

In the above instance, the expression key renewal block (KRB) is used for 
explaining data used for distributing the key. It should however be apparent from the 
foregoing description that the key renewal block is not limited to key renewal but may 
be applied to key distribution at large. 

For protecting the benefit of e.g., a content copyright owner, it is necessary for 
the licenced device to control the copying of the content. 

In recording the content on the recording medium, it is necessary to check 
whether or not the copying of the content is allowed (copying enabled) so that the 
content allowed for copying is recorded. If the content recorded on a recording 
medium is to be reproduced and output, it is also necessary to prevent illicit subsequent 
copying. 

The processing of the recording and/or reproducing device of Fig. 1 in case the 
content is recorded or reproduced as the content is controlled for copying is now 
explained with reference to Figs.27A, 27B, 28A and 28B. 

First, in recording the content of the digital signals from outside, the recording 
processing as shown in the flowchart of Fig.27A is carried out. Here, the recording 
and/or reproducing unit 100 of Fig. 1 is taken as an example. If the content of the 
digital signals (digital content) is sent over e.g., a 1394 serial bus to the input/output 
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I/F 120, the input/output I/F 120 at step SI 801 receives the digital content. The 
program then moves to step SI 802. 

At step S1802, the input/output I/F 120 checks whether or not the received 
digital content is allowed for copying. If the content received by the input/output I/F 
120 are not in the encrypted form, for example, if the plaintext content not employing 
the aforementioned DTCP are supplied to the input/output 1/F 120, the content is 
verified to be allowed for copying. 

It is also assumed that the recording and/or reproducing device conforms to 
DTCP and executes processing in accordance with the DTCP. The DTCP provides 
2-bit EMI (encryption media indicator) as the information for controlling the copying. 
The EMI of 00B indicates that the content is copy-free (Copy-freely), whereas the EMI 
of 0 IB denotes that the content is no more allowed for copying (No-more-copies). The 
EMI of 1 0B indicates that the content may be copied only once (Copy-one-generation), 
whereas the EMI of 1 IB denotes that the copying is inhibited (Copy-never). 

If EMI is included in the signal supplied to the input/output I/F 120 of the 
recording and/or reproducing device 100, and the EMI is Copy-freely or Copy-one- 
generation, the content is verified to be allowed for copying. If the EMI is no-more- 
copies or copy-never, the content is verified to be not allowed for copying 

If the content is found at step SI 802 to be not allowed for copying, the steps 
S 1 803 to S 1 804 are skipped to terminate the recording. Thus, in this case, no content 
is recorded on the recording medium. 
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If the content is found at step SI 802 to be allowed for copying, the program 
moves to step SI 803 such that the processing similar to that at steps S202, S203 in 
Fig.2A is carried out at steps S 1 803 and SI 804. That is, the encryption processing in 
the encryption processing means 150 is executed, and the resulting encrypted content 
is recorded on the recording medium 195 to terminate the recording processing. 

Meanwhile, the EMI is contained in the digital signals supplied to the 
input/output I/F 120, such that, when the digital content is recorded, the EMI and the 
information denoting the copy controlling state as does EMI, such as embedded CCI 
in DTCP, are also recorded along with the digital content. 

As a general rule, the information representing the Copy-one-generation is 
recorded as it is converted to No-more copies in order not to permit further copying. 

In recording the content of the analog signals from outside, the recording 
processing conforming to the flowchart of Fig.27B is performed. The processing of 
Fig.27B is now explained. When the content of analog signals (analog content) are fed 
to the input/output I/F 140, the input/output I/F 140 at step S181 1 receives the analog 
content and proceeds to step SI 8 12 to verify whether or not the so received analog 
content is allowed for copying. 

The processing of check at step S1812 is performed based on whether or not a 
macro-vision signal or a CGMS-A (Copy Generation Management System- Analog) 
signal is included in the signal received by the input/output I/F 140. The macro-vision 
signal is such a signal that becomes noise on recording on a video cassette tape of the 
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VHS system. If this signal is contained in the signal received by the input/output I/F 
140, the analog content is verified as being unable to be copied. 

Moreover, the CGMS-A signal denotes the CGMS signal used in copying 
controlling the digital signals and which is applied to the copying control of the analog 
signals. The CGMS-A signal denotes that the content is Copy-free, Copy-one- 
generation or Copy-never. 

Thus, if the CGMS-A signal is included in the signal received by an input/output 
I/F 140, and the CGMS-A signal denotes Copy- freely or Copy-one-generation, the 
analog content is verified to be allowed for copying. If the CGMS-A signal denotes 
Copy-never, the analog signals are verified to be not allowed for copying. 

If no macro-vision signal nor CGMS-A signal is contained in the input/output 
I/F 140, the analog signals are verified to be allowed for copying. 

If the analog signals are determined at step SI 812 not to be allowed for 
copying, the steps SI 823 to SI 8 16 are skipped to terminate the recording processing. 
Thus, in this case, no content is recorded on the recording medium 195. 

If it is verified at step S1812 that the analog content is not allowed for copying, 
the program moves to step S 1 8 1 3. In the steps S 1 8 1 3 to S 1 8 1 6, the processing similar 
to that at steps S222 to S225 in Fig.2B is performed, whereby the content is converted 
into digital data, MPEG encoded, decrypted and recorded on the recording medium to 
complete the recording processing. 

If, in case the CGMS-A signals are included in the analog signals received by 
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the input/output I/F 140, the analog content is to be recorded on the recording medium, 
the CGMS-A signals are also recorded on the recording medium. In this case, the 
infonnation representing the Copy-one-generation is converted, by and large, into No- 
more-copies, in order to prohibit further copying, and is recorded in this form. This, 
however, is not valid if a rule is adopted in a system which states: "The Copy-one- 
generation copy control information is recorded without conversion to No-more- 
copies, but is handled as No-more copies". 

If the content recorded on a recording medium are reproduced and output as 
digital content to outside, the reproducing processing in accordance with the flowchart 
of Fig.28A is perfonned. The processing of Fig.28A is now explained. First, at steps 
SI 901 and S1902, the processing similar to that at steps S301 and S302 of Fig. 3 A is 
carried out, whereby the encrypted content read out from the recording medium is 
decoded by the encryption processing means 150 so that the decrypted digital content 
is sent over the bus 1 10 to the input/output I/F 120. 

The input/output I/F 120 at step SI 903 checks whether or not the digital content 
supplied thereto is allowed for copying subsequently. That is, if, for example, the 
EMI, or the infonnation indicating the copying controlling state (copying controlling 
information) as does the EMI, is not contained in the digital content sent to the 
input/output I/F 120, the content is determined to be allowed for copying subsequently. 

If the copying controlling infonnation, such as EMI, is contained in the digital 
content supplied to the input/output I/F 120, that is if EMI is recorded in accordance 
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with the DTCP standard during content recording, and the EMI (recorded EMI) is 
Copy-freely, the content is determined to be allowed for copying subsequently. If the 
EMI is No-more copies, the content is determined not to be allowed for copying 
subsequently. 

By and large, the copying controlling information, such as EMI, as recorded, is 
not Copy-one-Generation nor Copying-never. The reason is that the EMI of the Copy- 
one -generation is converted during recording into No-more-copies, whilst the digital 
content having the EMI of Copy-never are not recorded on the recording medium. 
This, however, is not valid if a rule is adopted in a system which states: "The copy-one- 
generation copy control information is recorded without conversion to No-more- 
copies, but handled as No-more copies". 

If, at step SI 903, the content is determined to be allowed for copying 
subsequently, the program moves to step S 1 904 where the input/output I/F 1 20 outputs 
the digital content to outside to terminate the reproducing processing. 

If, at step S1903, the content is found to be allowed for copying subsequently, 
the program moves to step SI 905 where the input/output I/F 120 outputs the digital 
content to outside in such a form as to prohibit its subsequent copying, in accordance 
with the DTCP standard, to terminate the reproducing processing. 

That is, if, for example, the copying controlling information, such as recorded 
EMI, is No-more copies, or if in a given system, there is set a rule running: "the Copy- 
one-generation copy controlling information is recorded without conversion to No- 
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more-copies 



but is treated as No-more copies" and the EMI recorded under this 



condition is Copy-one-generation, the content is not allowed for further copying. 

So, the input/output I/F 120 effects reciprocal authentication with respect to 
counterpart devices, in accordance with the DTCP standards. If the counterpart is an 
authentic device, herein the device conforming to the DTCP standard, the digital 
content is encrypted and output in this form to outside. 

If the content recorded on the recording medium is reproduced and output to 
outside as analog content, the reproduction processing confonning to the flowchart of 
Fig.28B is performed. The processing of Fig.28B is now explained. In steps S191 1 
to S1914, the processing similar to that at steps S321 to S324 is performed That is, 
the readout, decryption, MPEG decoding and D/A conversion of the encrypted content 
are carried out. The resulting analog content is received by the input/output I/F 140. 

At step S 19 15, the input/output I/F 140 is verified as to whether or not the 
content supplied thereto is enabled for subsequent copying. For example, if the 
copying controlling information, such as EMI, is not co-recorded in the recorded 
content, the content is determined to be enabled for copying subsequently. 

If the copying controlling information, such as EMI, is recorded during 
recording of the content in accordance with, for example, the DTCP standard, and the 
information is Copy-free, the content is determined to be enabled for further copying. 

On the other hand, if, for example, the copying controlling information, such 
as recorded EMI, is No-more copies, or if, in a given system, there is set a rule 
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running: "the Copy-one-generation copy controlling information is recorded without 
conversion to No-more- copies but is h eated as No-more copies" and the EMI recorded 
under this condition is Copy-one-generation, the analog content detennined to be not 
allowed for further copying. 

For example, if the CGMS-A signals are contained in the analog content 
supplied to the input/output I/F 140, such that, during the recording of the content, the 
CGMS-A signals are recorded along with the content, with the CGMS-A signals being 
Copy- freely, the analog signals are detennined subsequently to be enabled for copying. 
If the CGMS-A signals are Copy-never, the analog content is detennined to be enabled 
for copying subsequently. 

If, at step S1915, the content is determined to be enabled for copying 
subsequently, the program moves to step S 1 9 1 6 where the input/output I/F 1 40 directly 
outputs the analog signals, supplied thereto, by way of terminating the reproduction 
processing. 

On the other hand, if, at step S 191 5, the content is determined not to be enabled 
for copying subsequently, the program moves to step S 1917 where the input/output I/F 
140 outputs the analog content in a manner of not allowing for subsequent copying to 
terminate the reproduction processing. 

That is, if, for example, the copying controlling information, such as recorded 
EMI, is No-more copies, or if, in a given system, there is set a rule running: "the Copy- 
one-generation copy controlling information is recorded without conversion to No- 
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more-copies but is treated as No-more copies" and the copying controlling 
infonnation, such as EMI, recorded under this condition, is Copy-one-generation, the 
content is not allowed for further copying. 

So, the input/output I/F 140 appends e.g., macro-vision signals or CGMS-A 
signals indicating Copy-never to the analog signals to output the resulting signals to 
outside. If the CGMS-A signals recorded are Copy-never, the content is not allowed 
for further copying. So, the input/output I/F 4 outputs the content to outside, along 
with the analog content, after converting the CGMS-A signals to Copy-never. 

By recording or reproducing the content as the content is controlled for copying, 
as described above, it is possible to prevent the copying outside the range allowed for 
the content (illicit copying). 

The above-described sequence of operations may be performed not only by 
hardware but also by software. For example, although the encryption processing 
means 150 may be arranged as encrypting/decrypting LSI, it may also be arranged by 
a configuration in which the program is executed by a general-purpose computer or a 
one-chip micro-computer. If this sequence of processing operations are executed by 
software, the program forming the software is installed on a general-purpose computer 
or a one-chip micro-computer. Fig.29 shows an illustrative structure of an embodiment 
of a computer on which is installed the program executing the above-described 
sequence of operations. 

The program may be pre-recorded on the hard disc 2005 or on the ROM 2003 
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as a recording medium built into a computer. Alternatively, the program may be 
transiently or permanently stored (recorded) in a removable recording medium, such 
as a floppy disc, CD-ROM (compact disc read only memory), MO (magneto optical) 
disc, DVD (digital versatile disc), a magnetic disc or on a semiconductor memory. 
Such removable recording medium 20 1 0 may also be furnished as a so-called package 
software. 

Meanwhile, the program may be installed on a computer from the above- 
mentioned removable recording medium 2010, transmitted over a radio path to the 
computer from a downloading site via an artificial satellite for digital satellite 
broadcasting, or transmitted to the computer over a cable through the networks, such 
as Internet. The computer is able to receive the so transferred program by a 
communication unit 2008 to install the program on a built-in hard disc 2005. 

The computer has a built-in CPU (central processing unit), to which CPU 2002 
an input/output interface 201 1 is connected over a bus 2002. If a command is input 
by a user acting on the input unit 2007, such as a keyboard or a mouse, over 
input/output interface 20 1 0, the program stored in the ROM (read-only memory) 2003 
is executed accordingly. 

Alternatively, the CPU 2002 loads a program, stored in the hard disc 2005, a 
program transferred from a satellite or a network, received by a communication unit 
2008 and installed on the hard disc 2005, or a program read out from the removable 
recording medium 2110, loaded on a drive 2009 so as to be installed on the hard disc 
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2005, on the RAM (random access memory) 2004, for execution. 

Thus, the CPU 2002 performs the processing conforming to the above-described 
flowchart, or in accordance with the configuration of the block diagram described 
above. The CPU 2002 outputs the processed results via e.g., input/output interface 
201 1 from an output unit 2006 formed e.g., by an LCD (liquid crystal display) or a 
loudspeaker, for transmission from the communication unit 2008 or recording on the 
hard disc 2005. 

It should be noted that, in the present specification, the processing steps stating 
the program designed for the computer to carry out a variety of processing operations 
are not necessarily processed chronologically in a sequence stated in the flowchart, but 
the processing also may include processing carried out in parallel or batch-wise, such 
as parallel processing or processing by an object. 

The program may be processed by one computer or by a plural number of 
computers in a distributed fashion. The program may also be transferred to and 
executed by a remote computer. 

In the present embodiment, the description has been made mainly on an instance 
in which the block for encrypting/decrypting the content is formed by a one-chip 
encrypting/decrypting LSI. However, the content encrypting/decrypting block may 
also be realized by one software module executed by the CPU 170 shown in Fig. 1. 

The present invention has so far been elucidated with reference to certain 
preferred embodiments. It is however apparent that the present invention can be 
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modified by the skilled artisan by correction or substitution of the embodiments within 
the scope not departing from the purport of the invention. That is, the present 
invention has been disclosed in the perspective of illustration and hence the scope of 



in a limiting fashion. 
Industrial Applicability 

With the information recording and/or reproducing device according to the 
present invention, described above, in which, by the key distributing configuration of 
the tree structure, renewal data of a content cipher key, such as a media key, is 
transmitted along with the renewal block (KRB), and in which, after the recording 
and/or reproducing device has acquired the media key of a certain recording medium 
by calculations, the media key so acquired is encrypted using a cipher key unique to 
the recording and/or reproducing device, such as a leaf key, for storage in a recording 
medium or in a memory of the recording and/or reproducing device, the media key can 
be calculated on decrypting the encrypted key only once when the recording and/or 
reproducing device next uses the recording medium. Thus, it is possible to diminish 
the volume of calculations, such as those involved in the KRB decrypting processing 
operations, which otherwise become necessary when the recording and/or reproducing 
device accesses the recording medium. 

By the key distributing configuration of the tree structure, the content key as the 
content cipher key is transmitted along with the key renewal block (KRB) and, after 



the present invention should be defined in light of the claims without being construed 
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the recording and/or reproducing device has acquired a content key of certain content 
on calculations, the so acquired content key is encrypted, using the cipher key proper 
to the recording and/or reproducing device, to form a cryptotext, which is then stored 
on a recording medium or in a memory of the recording and/or reproducing device. 
Thus, the content key can be calculated on decrypting the cryptotext only once when 
the recording and/or reproducing device next uses the content. The result is the 
reduced processing volume such as KRB decrypting processing needed each time the 
recording and/or reproducing device uses the content. 



